System Center Operations Manager by Jonathan Hambrook

September 3, 2007

Options for adding more detials to SNMP Alerts

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 4:17 pm

As many of you who use SNMP may be finding that all the Alerts come in with the IP Address. In a large environment this can be an issue and as this is the mechanism in which they are added to the SCOM Database there is no way around this directly. However…

You have 2 options to make this a little easier.

1st you can enter the DeviceName in the Alert Description:



2nd you can use the custom fields if you have the option. Alert Generated Rule will allow for Custom Field editing.

Again add: $Target/Property[Type=”MicrosoftSystemCenterNetworkDeviceLibrary6050000!Microsoft.SystemCenter.NetworkDevice”]/Name$ to the particular Custom Field.


Of course this is provided you have setup the SNMP setting on the device with the correct name you refer to that device.

This is what you will see in your Alerts: (I have blanked out the detail due to confidentiality)

Alert View:

Alert Description:

 Custom Field:

Hope this makes your life a little easier 🙂

August 13, 2007

Search SCOM Database for MOMUIGeneratedRule entries

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 9:08 pm

If you are getting MOMUIGeneratedRule descriptions in your reports here is an SQL Query that will list all of them and their descriptions.

select distinct
from rules r
join LocalizedText lt on lt.LTStringID = r.RuleID
join ManagementPack mp on mp.ManagementPackID = r.ManagementPackID
where rulename like ‘MOMUIGeneratedRule%’

July 18, 2007

Issue with changing ‘Default Action Account’ for a Server

Filed under: Issues, SCOM 2007 — opsmgr @ 3:44 pm


If you are looking at changing the ‘Default Action Account’ Rus-As Accounts for a server, even if you use an account with the right access you may find that the server greys out.

My findings have found this is more common on Domain Controllers or Servers in OU with blocked Group Policy (If you are using Group Policies to determine access). Meaning that the account setup when you installed the agent doesnt have the access to make changes to the Health Service setup.


Use HSLockdown to add the Action Account to the Health Service. You can do this using the command:

c:\”Program Files\System Center Operations Manager 2007″\
hslockdown “Management Group” /A “DOMAIN\USER NAME”

Note: I put in the exclimation marks (“) just to point out if you use spaces they will be required to run any commands.

July 12, 2007

Issue with creating new Performance Rules and Reporting on them.

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 2:36 pm


If you recall I blogged on this issue earlier and said I would investigate more. As a recap you can check out the screenshots to see the issue:
MOM UI Error 2 MOM UI Error

Basicly, you will see the something like MomUIGeneratedRule with a series of characters after it.


This happens when you create a custom performance counter in a Management Pack that is not the “Default Management Pack“.

I have heard that MS are working on this and have been able to replicate the issue, we should see a fix soon so check back as I will be moniroting this one closely.

July 5, 2007

Interesting Issue with Reports…

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 8:21 pm

Well today I found an interesting issue with the intedgrated Reports. You can rplicate this by doing the following:
1. Open System Center Operation Manager Console
2. Goto [-] Microsoft Windows Server [+] Windows Server State
3. Select a Server
4. In the Actions panel select one of the Performance History Reports
5. In the Report Details choose a date spanning months. (ie: 20th June to 10th July)

Now at first glance I thought I was missing data but then quickly realised what I was seeing was the correct data, just not in the expected display. Have a look at what I saw:

Wrapping SCOM Report

If you look closely you will see I have asked for a report to start on the 20th June and to run untill the 4th of July.

What I get however is the first 4 days of July before the last 10 days of June… I have posted this to MS and am awaiting a responce, however I would guess there is an issue with date formating issue, as in Australia we use DD/MM/YYYY.

UPDATE: MS have been able to replicate this and are working on some re-engineering of the Reports, could be hotfix or part of SP1.

July 3, 2007

Error: Access to the registry key ‘Global’ is denied.

Filed under: Errors, Issues, Microsoft, SCOM 2007 — opsmgr @ 9:01 pm

I noticed this Error in a few blogs and thought I would have a crack at it and I was able to recreate it in my lab.

Access to registry key Global is denied

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[UnauthorizedAccessException: Access to the registry key 'Global' is denied.]
Microsoft.Win32.RegistryKey.Win32Error(Int32 errorCode, String str) +2116595
Microsoft.Win32.RegistryKey.InternalGetValue(String name, Object defaultValue, Boolean doNotExpand, Boolean checkSecurity) +2779509
Microsoft.Win32.RegistryKey.GetValue(String name) +29
System.Diagnostics.PerformanceMonitor.GetData(String item) +96
System.Diagnostics.PerformanceCounterLib.GetPerformanceData(String item) +147
System.Diagnostics.PerformanceCounterLib.get_CategoryTable() +82
System.Diagnostics.PerformanceCounterLib.CategoryExists(String machine, String category) +65
System.Diagnostics.PerformanceCounterCategory.Exists(String categoryName, String machineName) +125
System.Diagnostics.PerformanceCounterCategory.Exists(String categoryName) +9
Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.Counters.BuildPerformanceCounter(DalCounter counterName, String instanceName) +302
Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.Counters..ctor() +197
Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory..ctor() +24
Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory..cctor() +20[TypeInitializationException: The type initializer for 'Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory' threw an exception.]
Microsoft.EnterpriseManagement.OperationsManager.DataAbstractionLayer.DataAbstractionFactory.GetInstance(IDataAbstractionBuilder builder) +0
Microsoft.EnterpriseManagement.OperationsManager.WebConsole.WebDalWrapper.get_OpsSdkWrapper() +37
BaseWebConsolePage.get_OpsSdkWrapper() +210
login.Page_Unload(Object sender, EventArgs e) +22

You will also get this error in the Event log on the Web Console server (Click to view full size):
Event 10

This is what I did to create the Issue and further down is the workaround which is a common fix for this issue in some other Blogs and also with other errors Microsoft have in their Knowledge Base that arn’t specific to SCOM.

To set the scene this is what I set out to achive. I wanted to create a New Monitoring Diagram View to display a couple of intranet sites that I want to monitor from all our national offices and unlike the Web Application State view I only wanted to see the Websites status ie: Health or Critical etc.

I order to do this I would have to do the following, create new Groups, new Monitor, new Management Pack, new View and to then restrict access to only show the one new View in the Web Console for a few people.

1. Created the Management Pack

2. Created the Web Application monitor for the sites

3. Created a Group and then added 2 other Groups as Child Groups. (One for each Application and added the appropriate Web Application to each group)

4. Created the new Monitor to report the status of the 2 Child Groups

5. Created the Custom Diagram View showing the Primary Group and the 2 Child Group.

6. Under Adminitriation I created a new Read-Only Operator, New user Role.

7. Added the Domain Users (Same Domain as SCOM is in) that would have access to this group and also specified that all they could see was the 3 new groups I had created and the new view as well as the Web Applications State view. (Now this is where I think I need to look further to see whats happening.)

8. I then accessed the Web Console and got the above error.

9. Applied the resolution: Added all the users from the new ‘User Role’ to the local Performance Monitor Users group on the server that runs the Web Console. (I however didnt add them to the local Users group as this is inherited by the Domain Users group. If this isn’t the case for you then you should make sure those users are also added to this group)

10. Closed all IE browser and Performed an IISReset (run from cmd)

11. Logged back on and EVERYTHING was working great. Here is what I saw for reference.
Monitoring View

June 30, 2007

Hardware Monitoring with SCOM 2007

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 3:30 pm

UPDATE — Looks like the Major 3 server hardware manufactures have now all released their Management Packs see the list below.

I work with most of the popular and even some un-popular providers and as such I will use this post to direct you to where you can get the latest hardware Management Packs:

 – Server & Blade Center: (You will need to log in. You will find the downloads at the bottom of the Windows pages. See screen Shot)
IBM Management Pack Download

– Server:

– Server:
– Storage Works:

Note: I have spoken to reps and have been told that the Management Pack for Acer Server will be out Q3 2007. This work has been outsourced to Microsoft to develop.

June 28, 2007

Custom created Management Pack with custom rules don’t show correctly in Reporting

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 8:59 pm

I have found the following Issue when creating a report from a Custom Performance Counter that was added to a Custom Management Pack.

If you would like to follow along, First, create a new Management Pack and then under Authoring create a Rule for a performance counter ie: % Processor Time.

Second, go to Reporting and under “Microsoft Generic Report Library” open the “Performance” report and fill out all the details. When you go to selecting the counter you will see an uninterperatable name. This is displayed as a sequence of numbers and letters where the counter name should be, this is obvious from the screenshot below:

Rule Name Not Showing correctly in SCOM Reporting

This becomes a real neusence when you get your report results as the ‘Rule:’ detail is not interperatable. So should you forget what you printed or saved, you will not be able to reference this in the feature. See the follow screenshot:

Performance Rule Unreadable Rule Name

I have highlighted where you should see what the counter name is, if you were to look back at this report in the future you would not be able to tell that it was % Processor Time.

Duplication in Reports – Issue found in SQL MP

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 8:48 pm

I have found a issue I have yet to verify with other Management Packs but will be doing some testing to see how common this is.

Basicly, if you install the SQL Management Pack and then Uninstall it and then reinstall it again, and in my case it was off for about 2 weeks. You may find when in the Monitoring pane that when you are highlighting an SQL server under Microsoft SQL Server – Active Alerts you see duplicate reports. See the screenshot below:

Duplicate SQL Reports

June 26, 2007

‘Design a report’ in SCOM Reporting fails to open successfully

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 2:49 pm


 When in the Reporting pane of System Center Operations Manager, you click on ‘Design a report’ and IE opens and then closes straight away with no error.


This is caused by the requirements of Microsoft’s ClickOnce technology not having the required IE setting configured. The minimum requirements can be found at

In summary of the article you need to enable to following configuration in IE’s Internet Option enabled:

.NET Framework-Reliant components
         – Run components not signed with Authenticode


  1. Open IE 7
  2. Click on Tools / Internet Options
  3. Select the Security Tab
  4. Select the zone ie: Local Intranet
  5. Click Custom Level…
  6. Find .NET Framework-relient components and enable the Run components not signed with Authenticode
  7. Apply and close IE

If your like me and have a Group Policy setting these settings, you will need to create a new Group Policy and import the IE Group Policy Template. This is located normaly in Windows\inf folder called inetres.adm.

Import this into an overwriting policy for the machines that require this setting.

June 20, 2007

Finding a MP Rule

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 7:08 pm

I have found and also reading a lot of posts in message boards that one of the big changes in moving from MOM 2005 to SCOM 2007 is where do MP rules go and how can i view them and disable or edit them. So here is a quick few steps to help you out:

1. Open the Operation Console
2. Open the Authoring section
3. Expand Management Pack Objects and click Rules
4. There is light yellow line which operates the Scope function
5. Click Change Scope
6. Now select the targets you are interested in viewing. (These are name very similar to the MP’s you have installed)
7. Click OK
8. Now you can Right-Click and perform the required override or view the rule properties.

Its good to note that most packaged MP’s are now ‘locked’ which means you will only be able to perform a limited set of functions on them. Bacause of this you are also not able to create new rules in a locked MP. Microsoft have you create your own MP and create all your new task and rules. So be sure to try and keep a standard when creating new MP’s as it will make management a lot easier.

June 19, 2007

SRS Server Validation Error – (407) Proxy Authentication Required

Filed under: Errors, Issues, Microsoft, SCOM 2007 — opsmgr @ 3:12 pm


If like me, you are behind a proxy and you use a proxy.pac file to athenticate to the Internet, and you have this set in IE. You may get an SRS Server Validation Error. To find out if this is the case use the following command line to log the instalation of the SCOM Reporting MSI:

msiexec /i reporting2007.msi /l*v c:\reportinglog.txt

Look at the reportinglog.txt file and you will see the following:

Action start 12:25:05: _ValidateSRSWebSiteBindingsCA_Wizard.
MSI (c) (58:44) [12:25:05:568]: Invoking remote custom action. DLL: C:\DOCUME~1\itsjrh\LOCALS~1\Temp\MSI2C2.tmp, Entrypoint: ValidateSRSWebSiteBindingsCA
MSI (c) (58!E4) [12:25:06:146]: PROPERTY CHANGE: Adding REPORT_SERVER_FULL_HTTP_PATH_VALID property. Its value is ‘0’.
MSI (c) (58!E4) [12:25:12:787]: PROPERTY CHANGE: Adding FailedMsgProperty property. Its value is ‘CheckHttpAddressResponse: Failed Status Code of The remote server returned an error: (407) Proxy Authentication Required.’.


Remove all proxy setting from IE and re-run Reporting installation.

June 18, 2007

Backout / Roll Back a SCOM Management Pack

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 4:00 pm

It would be nice if SCOM supported a Roll Back feature for its Management Packs like Windows does with drivers nowadays. However it doesn’t, so should you want to backout an MP you are going to need to remove it. You are unable to install an older version MP over a new version MP.

Removing a SCOM Management Pack is simple:
1. Open System Center Operations Manager 2007 Operators Console
2. Go in to the Administration section
3. Select the Management Packs in the left plane
4. Highlight the Management Pack you with to remove on the right
5. Right-Click and select Delete
6. Click YES to approve

Note: Some MP’s (ie: SQL) have dependancies and these will be shown as needing to be removed before you can remove the currently selected MP.

Once you have clicked delete it can take some time and you will notice that the TEMPDB in your Database Warehouse can expand to an incredible amount. I have seen it get upto 14GB! This something to keep your eye on as you will be removing all the data associated with the Management Pack.

May 14, 2007

Discoveries slow with a cluster?

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 8:35 pm

I have been working with SCOM for a while and I found that when you have a cluster that is being monitored the ScOM Root Management Server slows down with its discovery. I believe this is because when monitoring large clusters with many Databases and Virual Servers these are obviously viewed as Agentless devices. This is slightly contradictory as you actually do have an agent on each cluster node.

Its also becoming obvious to me that agent discovery is setup in a queue. This means that should you add a new system with lots of discoverable entities then this will need to complete first before the next lot of discoveries takes place.

When i mean discoveries I am talking about what the SCOM Agent will monitor, not server discoveries. My best advise to you if you find discovering slow, be patient 🙂

May 10, 2007

SCOM doesn’t pick up the Cluster Servers virtual devices

Filed under: Issues, Microsoft, SCOM 2007 — opsmgr @ 8:07 pm

Each physical node has to have “Agent Proxy” enabled (in the administration tab -> Agent managed)In case this was not set, restart the agent on each cluster node. The discovery reruns. Check now that each virtual node comes in under “agentless” managed. (in the discovered inventory it will show as “not monitored” which is ok)Now check under Windows Server (state view). Each virtual server has to be discovered. Check the properties, it has to say “Is Virtual Node” true. Now the SQL 2005 should work as well. Check the SQL state views (this may take a moment if the Virtual node was not discovered previously – again you can restart the agent on the cluster node where the SQL is currently active)

Here is a Step-by-step guide on exactly what to do.

  1. Open System Center Operations Manager Operator Console.
  2. Open the Administration view, and select Agent Managed under Device Management.
  3. Right-Click on the Cluster Nodes and select Properties.
  4. In the security tab tick the box that says Allow this agent to act as a proxy and discover managed objects on other computers.
  5. Click OK.
  6. On the Cluster Nodes restart the OpsMgr Health Service. (The Discovery will re-run)
  7. Open the Administration view, and select Agentless Managed under Device Management.
  8. You should see all the Cluster Virtual Servers.
  9. Open the Monitoring view, and select Discovered Inventory. It will show “not monitored” this is expected.
  10. Select Windows Server State under Microsoft Windows Server. (You should see the Cluster Object listed with their IP address).
  11. Right-Click the Cluster Virtual Servers select Properties.
  12. Check that the line saying “Is Virtual Node” is True (The SQL 2005 MP should work now)
  13. Select Database State under Microsoft SQL Server\Databases. (This may take a moment if the Virtual Servers were not previously discovered. You can re-start the OpsMgr Health Service where SQL is currently active to rescan).

Blog at